Privilege Elevation via Session Puzzling

Variants:
Direct 

Also Known As:
Session Variable Overloading, Session Poisoning

Vector Operation Method:
Malicious users can abuse hardcoded default session values or multiple components relying on identical session attributes to gain access to normally restricted locations in the application, via abnormal access sequences. Logical session puzzling attacks make use of forced browsing in customized sequences, hardcoded default session attributes, and in many cases, session poisoning.